[MEDIUM] Add JSON schema validation for hook inputs

[emiperez95]

Security Issue

Hook scripts parse JSON from stdin without validation, potentially leading to injection attacks or crashes.

Location

hooks/log_tool_operations.py:256

# No validation!
hook_data = json.load(sys.stdin)

Proposed Solution

1. Add JSON Schema Validation

import jsonschema

HOOK_SCHEMA = {
    "type": "object",
    "properties": {
        "session_id": {
            "type": "string",
            "maxLength": 100,
            "pattern": "^[a-zA-Z0-9-]+$"
        },
        "tool_name": {
            "type": "string",
            "pattern": "^[a-zA-Z0-9_-]+$",
            "maxLength": 50
        },
        "tool_input": {
            "type": "object",
            "maxProperties": 20
        }
    },
    "required": ["session_id", "tool_name"],
    "additionalProperties": False
}

def validate_hook_input(data):
    try:
        jsonschema.validate(data, HOOK_SCHEMA)
    except jsonschema.ValidationError as e:
        logger.error(f"Invalid input: {e.message}")
        sys.exit(1)

2. Add Size Limits

MAX_INPUT_SIZE = 10 * 1024  # 10KB

input_data = sys.stdin.read()
if len(input_data) > MAX_INPUT_SIZE:
    logger.error("Input too large")
    sys.exit(1)

hook_data = json.loads(input_data)

3. Sanitize String Values

def sanitize_string(value, max_length=1000):
    if not isinstance(value, str):
        return value
    # Remove null bytes
    value = value.replace('\x00', '')
    # Truncate
    return value[:max_length]

Testing

def test_malicious_input():
    malicious = {
        "session_id": "../../../etc/passwd",
        "tool_name": "'; DROP TABLE sessions; --"
    }
    with pytest.raises(ValidationError):
        validate_hook_input(malicious)

Effort: 2 hours

References

• CWE-20: Improper Input Validation
• PR feat: Add comprehensive monitoring with Prometheus and Grafana #1